Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-255)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-255 advisory. LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from source...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2023-2137)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.20+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2137 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product...

Amazon Linux 2 : libzapojit (ALAS-2023-2144)

The version of libzapojit installed on the remote host is prior to 0.0.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2144 advisory. In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it...

Amazon Linux AMI : wireshark (ALAS-2023-1785)

The version of wireshark installed on the remote host is prior to 1.8.10-25.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1785 advisory. Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in a...

Amazon Linux AMI : golang (ALAS-2023-1784)

The version of golang installed on the remote host is prior to 1.18.6-1.45. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1784 advisory. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a g...

Amazon Linux AMI : libX11 (ALAS-2023-1782)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1782 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that...

Amazon Linux 2023 : libzstd, libzstd-devel, libzstd-static (ALAS2023-2023-244)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-244 advisory. In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun. CVE-2022-4899 Tenable has extracted the preceding description block...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2023-2138)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.8+7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2138 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product ...

Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2023-256)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-256 advisory. 2023-07-20: The severity level was changed from low to medium. Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u371. Difficult to...

Amazon Linux 2 : pidgin (ALAS-2023-2115)

The version of pidgin installed on the remote host is prior to 2.10.11-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2115 advisory. An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to...

Amazon Linux AMI : python-imaging (ALAS-2023-1787)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1787 advisory. Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the crafted image file approach, related to an Insecure Sign Extension issue affecting the ImagingNew in Storage.c...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2139)

The version of open-vm-tools installed on the remote host is prior to 12.2.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2139 advisory. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2023-241)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-241 advisory. This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to oth...

Amazon Linux 2 : iniparser (ALAS-2023-2124)

The version of iniparser installed on the remote host is prior to 3.1-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2124 advisory. iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparsergetlongint which misses check NULL for function...

Amazon Linux AMI : cups (ALAS-2023-1777)

The version of cups installed on the remote host is prior to 1.4.2-67.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1777 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection...

Amazon Linux 2 : bind (ALAS-2023-2112)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2112 advisory. A vulnerability was found in BIND. The effectiveness of the cache-cleaning algorithm used in named can be severely diminished by...

Amazon Linux 2023 : python3-tornado (ALAS2023-2023-239)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-239 advisory. Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access...

Amazon Linux AMI : ncurses (ALAS-2023-1778)

The version of ncurses installed on the remote host is prior to 5.7-4.20090207.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1778 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory...

Amazon Linux 2 : c-ares (ALAS-2023-2127)

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2127 advisory. Denial of Service. An issue in c-ares was found where a 0-byte UDP payload can cause a Denial of Service CVE-2023-32067. Tenable ha...

Amazon Linux 2 : python-tornado (ALAS-2023-2132)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2132 advisory. Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a use...